I have a little ZyXEL VMG1312 router which is simply configured with VDSL WAN and an internet network / wifi which has all been working perfectly.

I want to allow remote RDP access to a computer ( on the internal network so setup a port forwarding rule for port 3389 and remote access was enabled.

I then realised that this was open to anybody, so have spent the 3 last hours attempting to apply IP restriction to the NAT rule, with zero success!

I have tried every combination under Access Control i can think of to restrict access to port 3389, even an any-any drop rule on the WAN-LAN direction for port 3389, with no luck - you can still access RDP from any IP.

Does anybody have any experience of configuring an ACL restriction to NAT rules on this router as it seems they do not apply at all? It doesn't seem to confirm to the same rules as every firewall/router i've ever used before!

Many thanks.

  • 1
    In general, consumer grade routers do not have the capability to do source IP based restrictions in combination with port forwarding (if they have the capability at all). The functions of these consumer routers is not intended for this type of application. If security is an issue, either close it up on the PC you are remoting into (long passwords, restricted accounts, etc) or use a 3rd party alternative like Teamviewer (just an example, not a recommendation). Or put your modem into bridge mode and use a router that does have these capabilities. – acejavelin Jan 15 '17 at 16:16

I have had it confirmed from the ZyXEL hardware team that this is a limitation and issue with their implementation of Port Forwarding on the VMG1312.

When Port Forwarding is enabled this will override any ACL and there is no fix for this.

It seems like a silly oversight and massively limits the usefulness of the ACL, but i guess time to get another smallbusiness-grade router rather than something for the residential market.

| improve this answer | |

If it's like the VMG3925 router (very similar, software looks the same) then you can specify a WAN 'from' address in the port forwarding that will limit it how you want I think.

However I agree the ACL is basically useless.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.